Filebrowser File Browser up to 2.63.16 Link Storage information disclosure

Summaryinfo

A vulnerability was found in Filebrowser File Browser up to 2.63.16. It has been classified as problematic. Impacted is the function sharePostHandler/shareListHandler/shareGetsHandler of the component Link Storage. The manipulation leads to information disclosure. This vulnerability is documented as CVE-2026-62684. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Filebrowser File Browser up to 2.63.16. This issue affects the function sharePostHandler/shareListHandler/shareGetsHandler of the component Link Storage. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST /api/share/{path} and GET /api/shares to expose password_hash and the bypass token, while an administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares. This issue is fixed in version 2.63.17.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-62684 since 07/14/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 2.63.17 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Filebrowser

Name

• File Browser

Version

• 2.63.0
• 2.63.1
• 2.63.2
• 2.63.3
• 2.63.4
• 2.63.5
• 2.63.6
• 2.63.7
• 2.63.8
• 2.63.9
• 2.63.10
• 2.63.11
• 2.63.12
• 2.63.13
• 2.63.14
• 2.63.15
• 2.63.16

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion